NewSAP Business Technology Platform, also named SAP Business AI Platform
In the last 30 days
93 changes
Today
Audit loggingcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note counted providers, said every provider is a service although a SAP-published practice for HANA audit policies now sits behind the door, and carried a typo. The state stays core-only: that practice is sap-official and no provider of another origin counts for the door.Audit logging
Authenticationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): no community artifact on the UI5 door provides this capability by an edge; the middlewares the text named provide ui5-build-tooling, and the only sample on the door is not a presence. what_core_does stays, so the core remains present.Authentication
Authorizationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): the note claimed every provider behind the door is an SAP service, a statement about the corpus that goes stale, and did not name the fresh btp-oauth provider. Coverage state unchanged: only SAP-official services count behind this door.Authorization
Certificate managementcore coverage, coverage by ecosystem revisedReassessed against the graph (check:capabilities): the note was an absence claim about providers; the new SAP provider btp-custom-domain is sap-official, so core-only still holds.Certificate management
Show 4 more
Identity provisioningcore coverage revisedReassessed against the graph (check:capabilities): the note claimed every repository behind the entry is a sample, which stopped being true when the SAP-official service entry arrived. State stays core-only.Identity provisioning
Rate limitingcore coverage revisedReassessed against the graph (check:capabilities): API Management, an SAP-official service on the BTP door, lists CAP in serves_ecosystems and provides this capability, so the core is present for CAP beside the in-process community plugins. The relationship stays unassessed for lack of documentary evidence on the history.Rate limiting
Secrets rotationcoverage by ecosystem revisedReassessed against the graph (check:capabilities): SAP Credential Store is sap-official and lists cap in serves_ecosystems, so SAP is present for CAP.Secrets rotation
Vulnerability scanningecosystems, description revisedPublic feedback issue #10. CAP and UI5 coverage assessed as unmapped: no atlas artifact provides the dependency-tree check there yet.Vulnerability scanning
Mon 19
🔴 Your Agent Wants to Call SAP. Now What?publishedDevtoberfest 2026 session INT-23, on what belongs between an agent and an SAP system. A solution advisor and an enterprise architect point Joule Desktop extensions at MCP servers built on API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp inside SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp, and ask it for business partners, orders and line items from an S/4HANA demo system; asked for the ten largest customers it answers from a sample of 200 orders rather than reading the whole table. They then open the API proxy behind it, where a spike arrest policy caps the backend at ten calls per second and the MCP server is configured to expose only the GET resources of the business-partner API so that an agent cannot create one, which is where the edges to Serve your application over MCPServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and Rate limitingRate limitingCapping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.SAP and community, unassessed hold. For totals across all sales orders they send the agent to SAP Business Data CloudSAP Business Data CloudSAP's umbrella over the data estate: installed intelligent content and data products, a governed catalog they are published through, and a path out to SAP Databricks.sap official, btp instead of the transactional system, since it aggregates and is read-only, and back through Integration Suite for writes such as journal entries.Rate limiting
MCP Gateway in Practice: Architecture, configuration, and hands-onpublishedA Devtoberfest 2026 integration-track session (INT-21) on the MCP gateway of SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: curated enterprise APIs served to agents as MCP tools over JSON-RPC, behind the authentication, authorization and traffic policies an API artifact already carries, with the existing API layer left in place. The hands-on half composes S/4HANA plant, material-stock and supplier data with a non-SAP location-risk source into one business data graph, downloads its OpenAPI specification, creates an MCP server artifact with tools, prompts and a surge-protection policy over that endpoint, and publishes it as a product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent developer subscribes and gets OAuth credentials. An MCP client then asks for 15 brake pads and ranks plants by stock, location risk and distance from Walldorf, which is what the agent access to your systemsAgent access to your systemsGiving an AI agent access to the business data, configuration or operations of systems you run through an MCP server. Serving your application over MCP exposes your own service contract; system access reaches the systems behind it, and one implementation may do both. Development assistance belongs to agent access to your code.SAP and community, narrow by design edge rests on; the Q&A covers principal propagation to the backend, how errors reach the model, and which Integration Suite editions carry the gateway.Rate limiting
Powering Enterprise-Ready Agentic AI with SAP Integration SuitepublishedA Devtoberfest 2026 session (INT-31) from SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp product management on the MCP gateway. The demo creates an MCP server in a design package from an API already deployed on the tenant, exposes two of its 300-odd resources as tools, attaches authentication and quota policies on a policies tab, and publishes the deployed endpoint as an AI product in Developer Hub of API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, where an agent subscribes and receives a token, URL, key and secret; the calls then show up in monitoring, in message processing logs and in the analytics dashboard, which is the MCP exposureServe your application over MCPExposing selected application data and business operations to an AI agent through the Model Context Protocol. An application may also integrate remote services through service integration, connecting its exposed contract with agent access to your systems. Development assistance belongs to agent access to your code.SAP and community, narrow by design and the tool governanceTool governanceControlling what an agent may call, with which authorisations, and leaving an audit trail of what it did. The authorisation question that MCP exposure raises but does not answer.SAP and community, unassessed the edges rest on. Three AI features inside Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp follow: a content migration agent that converts a PI/PO Java mapping into a Groovy script and generates a second integration flow for its lookup, memory profiling during a flow simulation, and root-cause analysis on a failed message processing log.Rate limiting
@marianfoo/sap-mcp-authdescription, type properties, connects revisedRe-read against the README as it stands today. "No token endpoint" and "there is no client-credentials flow to use instead" were absence claims about SAP's portals that no source makes, so they are gone and the paragraph now says what the module does and whom it serves. The maintainer's own unofficial caveat, and the origins password login refuses, are in when_not_to_use. The package block states that it is imported into the caller's own program and installed from npm. The README names Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the tenant the login goes to, which is an edge rather than a phrase in a paragraph.Authentication
Show 1 more
Authenticationecosystems revisedui5-middleware-oidc was staged in intake-20261019-bestofui5 under ui5-build-tooling because this capability was not open on the UI5 door. The UI5 reading comes from the README of SAP's backend-proxy-middleware.Authentication
Sat 17
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Data privacy
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Data privacy
An approach to secure multiple integrated SAP CAP java applications with a common XSUAA service instanceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
API Composition: Seamless Enterprise Data Access for Developers and AI Agentsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Rate limiting
Show 38 more
Authenticationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Authentication
Authorization Management Service in SAP Cloud Identity Serviceexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Dynamic authorisation with user attributes in SAP CAP and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token Retrievalexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authorization
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Evolving the identity lifecycle for an AI-first futureexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
From XSUAA to AMS: Architecting S4HANA CAP Extensions with Policy-Based Authorizationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
How SAP secures enterprise AI agents with identity propagationexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
How to get authenticated user information with CAP in three different ways – Using the XSUAA APIexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Insights of Cloud SDK, CAP, XSUAA, SSH and other BTP topics from 2021explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
IPS provisioning to ABAP Cloud Developer Trialexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Identity provisioning
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integrationexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Principal Propagation from BTP Web App to S/4HANA via SAP Integration Suiteexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features Tourexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Rate limiting
SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Rate limiting
SAP BTP Audit Log Access Just Got Easier - Here’s What’s Newexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Audit logging
SAP BTP Audit log Enable and retrieve logsexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Audit logging
SAP BTP XSUAA Security Configuration Comparison: Attribute-Based vs. Authority-Based Approachesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP Business Technology Platform: Authorization and Trust Management Serviceexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authorization
SAP CAP JWT Token Flow in codeexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP IAM integration with SAP Cloud Identity Servicesexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
SAP Job Scheduling Service + Cloud Application Programming Model application (CAP) + SAP Authorization and Trust Management Service (XSUAA)explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Secrets rotationdescription revisedKeep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit.Secrets rotation
Secure Service Consumption Across Hyperscalersexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
Securing a CAP Node.js App with SAP AMS on BTP Cloud Foundryexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Securing CAP Applications with SAP Cloud Identity Services and AMSexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and Playwrightexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authentication
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Useful CAP CDS and Fiori Commands to Accelerate Development and Deploymentexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Using Postman for API Testing with XSUAAexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Why developers should care about credential-types for xsuaa?explains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDexplains revisedDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).Authentication
XSUAA Based Authentication - Using Managed Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
XSUAA Based Authentication - Using Standalone Approuterexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
XSUAA Local Testingexplains revisedDoor scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).Authorization
Fri 16
SAP BTP Platform Technical User for CTMS IntegrationpublishedWalks through creating a technical user in Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Authentication
Thu 15
@saptools/cf-xsuaaadded to the atlasOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingAuthentication
@arc-mcp/xsuaa-authprovides[capability:authentication] revisedThe BTP door now compares its authentication options on whether the signed-in identity reaches the next system. The README's sentence about the
./btp entrypoint states it for this package, and it was read again on this date.Authentication@saptools/cf-xsuaaprovides[capability:authentication] revisedOn a capability page the edge put a token command line beside an OAuth server and an identity provider with nothing to tell them apart. The edge now says which part of the concern it answers, that it validates nothing, and states the property the BTP door compares on: a token with no user present.Authentication
Authenticationcoverage by ecosystem, facets, framing by ecosystem revisedThe paragraph counted two services while seven entries stand behind the door, the router and the Cloud Connector among them, so it told a reader the door was smaller than it is.Authentication
Show 3 more
Cloud Identity Servicesprovides[capability:authentication] revisedThe only sentence about this service was its one-liner, so the capability page listed it beside the OAuth server with nothing to tell the two apart. SAP's trust and federation page states what the service is and what a tenant's own policies cover, and the default identity provider page states the corporate identity provider behind it, which is the property the BTP door now compares on.Authentication
OAuth 2.0 on SAP BTPlifecycle, provides[capability:authentication] revisedThe BTP door now compares its authentication options on whether a token can be had with no person present. The catalogue sentence about the client credentials grant states it for this service, and it was read again on this date.Authentication
SAP Authorization and Trust Management serviceprovides[capability:authentication] revisedThe edge said only that the service answers authentication, so the page could not say which part of the concern it answers. SAP's architecture page states the three: the trust, the assertion it receives, and the token it signs. The two properties the BTP door now compares options on are stated from the same page: a token with no user present, and a corporate identity provider behind it.Authentication
Tue 13
Integrate SAP Business Technology Platform audit logs with IBM Security QRadarpublishedWalks through pulling entries from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp for a Cloud Foundry subaccount, via its retrieval API and a service key downloaded from the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp, into IBM Security QRadar as a Universal Cloud REST API log source. A sample audit event, a
data read event under audit.data-access, drives a custom QRadar DSM mapping event ID and category, then the walkthrough deletes a user from a Kyma role collection and shows the matching audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only entry arrive in QRadar as an offense.Audit loggingNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixpublishedWritten after the SAPwned disclosure in SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry RuntimeSAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp and SAP BTP, Kyma runtimeSAP BTP, Kyma runtimeA fully managed Kubernetes runtime on SAP BTP, based on the open-source project Kyma, where extensions to SAP solutions run as containerised microservices and serverless Functions.sap official, btp app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.Audit logging
SAP BTP Audit log Enable and retrieve logspublishedWalks through enabling and retrieving records from the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP's Cloud Foundry environment: the default oAuth2 service plan retains audit data for 90 days at no cost, while the premium plan adds a configurable retention period and lets an application write its own audit data. Covers the three subscription plans (premium, default for a subaccount, central for a global account) and the CLI steps to create a service instance and key, then retrieve records as JSON through the Auditlog Management Service's REST API using an OAuth2 client-credentials token in Postman.Audit logging
SAP Business Technology Platform: Authorization and Trust Management ServicepublishedWalks through how the SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btp secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btp's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.Authorization
Mon 12
How to enable SAP Audit Log Viewer service to collect all Audit logs from BTP Services - Part 1publishedWalks through subscribing to the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp's viewer app from the SAP BTP cockpit and creating a RoleCollection from the auditlog-management and auditlog-viewer role templates, assigned to a user or by a rule on the IDP's SAML assertion, to read audit loggingAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only events in a subaccount. The post's own update notes that a BTP release from 19 February 2026 removed the need for that role-assignment step. It also lists which Cloud Foundry services write audit log events, pointing to each service's own auditing page rather than detailing them here.Audit logging
Microsoft Sentinel for SAP goes agentlesspublishedExplains how Microsoft Sentinel for SAP's new agentless data connector drops its Docker-based collector agent by reusing an existing SAP Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp setup together with SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp: on SAP NetWeaver 750 and later, a small set of RFC function modules must be reachable from Integration Suite, added as an RFC connection in the subaccount's DestinationsDestinationsReaching a system that is not yours — an S/4HANA tenant, an on-premise service, a third-party API — without the address, the credentials or the tunnel being written into the application. The destination is the indirection, and the reason an endpoint can move without a redeploy.SAP and community, unassessed maintenance view, with a user authorised to call them (RFC connectivityRFC connectivityCalling ABAP function modules from outside the system over RFC, with destinations and connection pooling handled rather than hand-wired on the calling side.SAP and community, narrow by design). It also covers calling the audit logAudit loggingRecording who touched personal or sensitive data, in a form an auditor accepts, without hand-writing it in every handler. It is often confused with application logging, which records what the code did rather than who accessed what.SAP only API remotely, which on older releases needs SAP note 3054326 and a different integration-package configuration.Audit logging
API Managementprovides[mcp-servers], provides, description revisedIndependent source review supports prompts guiding agent interaction rather than templates; retains both sourced tool-count limits as an explicit MCP-specific discrepancy.Rate limiting
Sun 11
Evolving the identity lifecycle for an AI-first futurepublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design and Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Authentication
Future-ready access governance from SAP: Strategy and innovationpublishedStrategy and road map for SAP Access Control and SAP Cloud Identity Access Governance: AI-enabled governance, hybrid deployment options and identity services for securing SAP landscapes and compliance. Neither product has an entry here; the edge is to Identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only, the nearest concern, since access governance decides which users hold which roles in which systems, and the abstract names no identity service by name. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Identity provisioning
How SAP secures enterprise AI agents with identity propagationpublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design side and the per-hop check the authorisationAuthorizationDeciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.SAP and community, unassessed side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar KoscheGunnar Koschegave 1 talk, contributed to 1 entry and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.Authentication
Identity lifecycle and governance with SAP services and Microsoft EntrapublishedCloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.Authentication
Show 2 more
Road map for SAP Integration Suite: What ships next across all capabilitiespublishedSAP's road map for SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp across its capability areas: API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, event-driven integration, business process and trading partner integration, and hybrid runtimes for SAP and third-party systems. The abstract promises recent deliveries and the planned innovations that make the platform agent-ready within SAP Business AI Platform; it names the areas and no shipping item, so the edges rest on the product and the one area it names by a product name. A TechEd 2026 session (Thursday 29 October, Berlin; also IN804V, virtual), written here from SAP's abstract; the recording is not yet published.Rate limiting
Road map: SAP Business AI Platform security and SAP Cloud Identity ServicespublishedThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.Authentication
Thu 8
btp-ui5-show-userinfoadded to the atlasUI5 app reading the signed-in user via launchpad and approuter
Wed 7
Making the Case for Enhanced REST Adapter in SAP Integration SuitepublishedCatalogues what SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's native HTTP adapter supports for authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handlingError handlingTurning a failure into a response a client can act on — protocol-correct error payloads, correlation, and a boundary between internal detail and what a caller sees.SAP and community, unassessed (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPIOpenAPIHanding a description of the service to clients and tools — an API portal, a code generator, a partner who wants a contract before they write anything.SAP and community, narrow by design import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.Authentication
Sat 3
IPS provisioning to ABAP Cloud Developer TrialpublishedWalks through provisioning users and groups from SAP Cloud Identity Services' Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp into an ABAP Cloud Developer Trial system on Docker, reached through a Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp and an RFC destination in the BTP subaccount. The author's lessons learned tie the setup to the identity service's own constraints: the subaccount needs a Connectivity Plan and must share the Cloud Identity Service tenant's region, and on the ABAP side an IAS group lands as a Business Role rather than in SUGR, with the Login Name mapped to SU01's user field.Identity provisioning
Wed 30
#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 1publishedFirst of a three-part series on designing a CAP application on BTP that uses the platform's data privacyData privacyDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.SAP only services, and this part is the vocabulary before any of it: personal data, the rights a data subject has under GDPR, and the data controller and processor distinction, worked through an order-confirmation SMS example. It names four BTP services: SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btp, SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btp, SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp and SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. Only the first is described, as a service running in the Cloud Foundry environment that finds data subjects across one or more applications and services, makes requests on an individual's behalf about their personal information and forwards them for handling, and notifies individuals which of their personal information is being used or sends them a copy of their record by email; the CAP-side annotations and PDM's own application features follow in Part 2#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 2Walks through wiring a CAP service to SAP's Personal Data Manager (PDM) on BTP: entity, key and field-level @PersonalData annotations that mark data subjects and personal fields, the @PersonalData.IsPotentiallyPersonal / IsPotentiallySensitive distinction that drives audit logging, and the @Communication.Contact annotation PDM needs to search for a data subject. Covers the xsuaa trust arrangement and service binding that let the standalone PDM application call back into the CAP service to read and manage that data. Second of a three-part series; the annotation model it demonstrates is CAP's own mechanism for data privacy compliance, exercised against a sample 'Game Shop' application.Ajit_K_Panda, published 2023-03-18 and Part 3#SAPCAP: Win Customer Trust using Data Privacy and Protection Services on BTP - Part 3Third of a three-part series, this covers the UI side of SAP's Personal Data Manager (PDM) once it is subscribed and wired to a CAP application: a Customer Service Representative searches for a data subject, views the personal data the application's annotations expose, and requests correction, deletion or export on their behalf, while an Operators Clerk processes those requests through to completion. PDM stores none of the personal data itself, only the requests and access logs, which an administrator downloads through the separate Data Transport app. It builds on the annotation model the first two parts introduce, so what it demonstrates is PDM's own delivered UI rather than anything a CAP application must build itself.Ajit_K_Panda, published 2023-03-18.Data privacy
How to handle “usernames”, “Global User IDs” and “external IDs” in your landscape?publishedExplains what a username, a Global User ID and a SCIM2 external ID each are and when to use them: the username is the mutable attribute a person authenticates with, the Global User ID is the correlation attribute SAP uses when the same user must be identified between the applications they are provisioned into, and the external ID is mutable, defined by the client and optional within SCIM2. Argues against deriving any of the three from personal data, because they appear in read-only log files and other traces, some applications do not allow an ID change at all, and DevOps staff with access to those logs would otherwise see personal data they are not allowed to see. Recommends generating values without personal data, in uuid format, for technical integrations such as SAML or OIDC flows and SCIM-based replication, and keeping attributes like an email or display name for logon aliases and for what a user interface shows; notes that Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp already generates the SCIM ID and Global User ID in uuid format for each record.Identity provisioning
Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerpublishedWalks through wiring an Identity Authentication tenant of Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp into the SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Audit logging
SAP Cloud Integration (CI/CPI) - Reusable Script Collection Pattern for Sensitive Data MaskingpublishedOpens with the question compliance teams ask about Cloud IntegrationCloud IntegrationBuilds and runs integration flows that process, route and map messages between cloud and on-premise systems, SAP and non-SAP, through prebuilt adapters; available only under an SAP Integration Suite plan.sap official, btp, whether an integration team based outside Europe with Message Monitoring access can read the personal data in a logged payload, and answers that in most standard configurations it can. The pattern against it is a reusable Groovy script collection plus one global variable holding the masking rules: a script near the start of an iFlow AES-encrypts the original payload into a header or property and replaces values in the body by value pattern first and field-name keyword second, a second script restores the original just before the sender, so a Log Payload step anywhere in the flow captures the masked body while the target system still receives the real data. The post names its own limits, that pattern-based masking is heuristic and that CPI trace can capture the payload before the scripts run, and grounds the pattern in GDPR Articles 5(1)(f), 25, 32 and 44-49, reading the EDPB's Guidelines 05/2021 to mean that access from a country without an EU adequacy decision, uncovered by Standard Contractual Clauses or another valid transfer mechanism, can itself constitute a cross-border transfer.Data privacy
Show 1 more
What Happens to Your Data When You Enable SAP's AI Features?publishedTraces where a prompt goes when Joule, the Generative AI Hub or the orchestration service calls a third-party model through SAP AI CoreSAP AI CoreSAP's AI service on BTP: the runtime for AI assets, and through the Generative AI Hub inside it the access to foundation models, the orchestration service with its templating, masking, filtering and grounding modules, the Prompt Registry and Document Grounding.sap official, btp: the prompt and the business context around it travel to a model such as GPT-4o, Claude or Gemini for inference, and masking through SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btp is an optional orchestration module rather than a default, so with no masking block in the @sap-ai-sdk/orchestration@sap-ai-sdk/orchestrationThe Orchestration Service client of SAP's AI SDK, which applies templating, grounding, filtering and masking around a model call rather than in the application.sap official, cap client config nothing is masked. On the masking options, which the author says he confirmed with SAP AI Core product management, anonymization discards the original value and pseudonymization keeps it reversible; DPI recognizes person names, email addresses and phone numbers, plus custom entities defined by regex, which leaves commercially sensitive non-PII such as a revenue forecast or a project codename to pass through unless someone writes a pattern for it, and whether that data is covered at all is one of three answers the post marks as still pending. The "no training" assurance for third-party providers is read as contractual rather than technical, and models hosted and managed by SAP, Mistral among them, are named as a path other than a US-hyperscaler-hosted one.Data privacy
Tue 29
Automating User Offboarding in SAP BTP Across Multiple Subaccounts with PowerShell & BTP CLIpublishedA PowerShell script that pairs with the SAP BTP command line interface to delete a list of user e-mails from every trusted identity provider, sap.default included, across every subaccount the caller can reach, writing a timestamped log of each attempt. It automates the offboarding half of identity provisioningIdentity provisioningGetting users, groups and role assignments into every system that needs them, and out again when a person leaves, through provisioning jobs or SCIM APIs. Authentication answers who is calling one request; provisioning decides whether the user exists in that system at all.SAP only — getting a user out of every system that holds them once they leave — by chaining
btp list accounts/subaccount, btp list security/trust and btp delete security/user rather than going through a provisioning job or the SCIM API.Identity provisioningSAP BTP Audit Log Access Just Got Easier - Here’s What’s NewpublishedAnnounces that the Audit Log Viewer no longer needs a per-subaccount subscription: entitlement and setup now happen automatically in every subaccount of SAP Audit Log serviceSAP Audit Log serviceIngests compliance audit data from BTP services and applications and keeps it for ninety days by default; retrieval and longer retention are separate services.sap official, btp. It also adds a viewer at the Global Account level, opened directly from the BTP cockpit rather than through a dedicated instance.Audit logging
Mon 28
Useful CAP CDS and Fiori Commands to Accelerate Development and DeploymentpublishedA command-by-command walkthrough of
@sap/cds-dk's cds add and fiori add generators: cds add xsuaa writes an XSUAA security configuration from the CDS model's authorization annotations, and cds add hana together with cds deploy --to hana switches persistence from the default SQLite database to SAP HANA CloudSAP HANA CloudThe managed database under most of this: CAP's default target, the store Datasphere and Analytics Cloud sit on, and a service with plans and components.sap official, btp. cds add mta and fiori add deploy-config, from @sap/generator-fiori@sap/generator-fioriThe single entry point for generating a Fiori application — the user picks a template and the generator produces the project around it.sap official, cap, build the Cloud FoundrySAP BTP, Cloud Foundry RuntimeThe Cloud Foundry runtime of SAP BTP: memory for applications in a Cloud Foundry org, run from SAP's Java, Node.js and Python buildpacks or community buildpacks and managed with the standard Cloud Foundry tools.sap official, btp deployment descriptor together, adding a destination-service block and an xs-app.json that routes the Fiori app's calls through a named destination.AuthorizationSun 27
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!publishedWalks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration SuiteSAP Integration SuiteSAP's integration service on BTP: Cloud Integration for orchestration, API Management in front of it, and an MCP gateway that serves a managed API to agents.sap official, btp's API ManagementAPI ManagementAPI proxies in front of backend services, with security and traffic management policies attached to them, and Developer Hub where consumers subscribe.sap official, btp, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.Authentication
Audit loggingcore coverage revisedcapire audit 2026-09-27: a page this capability owns was cited nowhere.Audit logging
Authenticationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: the security overview and the product security overview were cited nowhere; the first carries a boundary SAP draws itself.Authentication
Authorizationcore coverage revisedcapire audit 2026-09-27, proposed pages read once more: a page this capability owns was cited nowhere.Authorization
Show 1 more
Data privacycore coverage revisedcapire audit 2026-09-27, judgement pages read a fifth time: the description says data privacy is doing what the law requires, and the security index's table calls data privacy a legal concept and data protection a suite of security measures; the row is quotable as written.Data privacy
Sat 26
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDpublishedA step-by-step configuration walkthrough for wiring SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp as the trust and user-correlation layer behind SAP Task CenterSAP Task CenterOne inbox across SAP applications: tasks from S/4HANA, SuccessFactors, Ariba and BTP workflows in one list, with a public API for a custom task provider.sap official, btp: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity ProvisioningSAP Cloud Identity Services - Identity ProvisioningProvisioning jobs that carry users and groups, with their authorisations, between cloud and on-premise business systems, SAP and non-SAP, in full or delta read mode.sap official, btp jobs, and the principal-propagation trust the cloud connectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp needs to pass it through to an on-premise task provider.Authentication